Threats tagged 'ghsa-h682-23cr-8m53'

Apache bRPC versions prior to 1.18.0 contain an unbounded memory accumulation vulnerability in the stream message reassembly path. This flaw allows remote attackers to cause a denial of service by sending an endless sequence of continuation data frames, leading to memory exhaustion. The issue arises because fragmented stream messages accumulate continuation frames without a size limit, causing the server to consume excessive memory until it crashes or becomes unavailable. The vulnerability affects services accepting streams from untrusted clients using the built-in streaming protocol.